CVE-2026-97076: WP Rocket Code Injection Vulnerability

CVE-2026-97076 Overview

CVE-2026-97076 is an executable regular expression vulnerability [CWE-624] in the WP Rocket WordPress plugin by WP Media. The flaw affects all versions of WP Rocket prior to 3.23.5 and enables unauthenticated attackers to trigger a denial of service condition over the network. According to the Patchstack advisory, maliciously crafted input processed by vulnerable regex patterns can exhaust server resources and disrupt availability of affected WordPress sites.

Critical Impact

Unauthenticated remote attackers can degrade or disable WordPress sites running vulnerable WP Rocket installations without user interaction or privileges.

Affected Products

• WP Media WP Rocket plugin for WordPress
• All WP Rocket versions before 3.23.5
• WordPress sites with WP Rocket caching enabled

Discovery Timeline

• 2026-10-09 - CVE-2026-97076 published to NVD
• 2026-10-11 - Last updated in NVD database

Technical Details for CVE-2026-97076

Vulnerability Analysis

The vulnerability is classified as an Executable Regular Expression Error [CWE-624] in the WP Rocket caching plugin. WP Rocket processes user-controllable input through regular expression patterns during its page caching and optimization workflows. When these patterns execute against attacker-crafted input, they consume excessive CPU and memory, leading to resource exhaustion on the host web server.

The Patchstack advisory categorizes the issue as a denial of service vector. The flaw does not expose confidentiality or integrity, but availability impact is high because a single unauthenticated HTTP request path can degrade service for all site visitors.

Root Cause

The root cause is the use of regular expression constructs that permit catastrophic backtracking or dynamic pattern execution against untrusted input. The plugin's input validation does not sufficiently constrain the structure or length of data passed to the regex engine. WP Media addressed the issue in version 3.23.5 by hardening the affected pattern logic.

Attack Vector

The attack is executed remotely over the network with no authentication and no user interaction. An attacker sends crafted HTTP requests to a WordPress site running a vulnerable WP Rocket version. The server-side PHP regex engine processes the payload, causing a sustained spike in CPU consumption that stalls PHP-FPM workers and renders the site unresponsive.

See the Patchstack WP Rocket Vulnerability advisory for additional technical context. No public proof-of-concept exploit is currently listed in the enriched data, and the EPSS score is 0.29%.

Detection Methods for CVE-2026-97076

Indicators of Compromise

• Sustained PHP-FPM or Apache worker processes consuming 100% CPU tied to WP Rocket code paths
• Elevated response latency and HTTP 502/504 errors from WordPress endpoints during attack windows
• Repeated requests from a single source containing unusually long or repetitive URL parameters, cookies, or headers processed by WP Rocket

Detection Strategies

• Monitor WordPress plugin inventories for wp-rocket versions below 3.23.5 using asset management or vulnerability scanners
• Correlate web server access logs with CPU utilization spikes to identify regex-driven resource exhaustion patterns
• Alert on sudden drops in request throughput paired with increased PHP execution time on sites running WP Rocket

Monitoring Recommendations

• Enable PHP slow-log collection with a threshold low enough to capture long-running regex evaluations
• Forward web server, PHP, and WordPress logs to a centralized SIEM for correlation and retention
• Baseline normal request patterns against WP Rocket cache endpoints to detect anomalous payload shapes

How to Mitigate CVE-2026-97076

Immediate Actions Required

• Upgrade the WP Rocket plugin to version 3.23.5 or later on all WordPress installations
• Audit WordPress environments to inventory every site running WP Rocket and prioritize public-facing instances
• Place a Web Application Firewall (WAF) in front of affected sites with rate limiting on request size and frequency

Patch Information

WP Media released WP Rocket version 3.23.5, which remediates the executable regular expression error. Administrators should apply the update through the WordPress plugin manager or by downloading the patched release from the vendor. Refer to the Patchstack WP Rocket Vulnerability advisory for vendor coordination details.

Workarounds

• Temporarily deactivate the WP Rocket plugin on sites that cannot be patched immediately
• Configure WAF rules to drop oversized query strings, headers, and cookies before they reach PHP
• Enforce per-IP request rate limits at the reverse proxy or CDN layer to blunt resource exhaustion attempts

# Update WP Rocket to the patched version using WP-CLI
wp plugin update wp-rocket --version=3.23.5

# Verify the installed version
wp plugin get wp-rocket --field=version